@transferwise/components 0.0.0-experimental-1d81581 → 0.0.0-experimental-a06eb0d

package/build/Markup/utils/sanitise.js

@@ -12,69 +12,69 @@ const ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;
 const IPV6_BRACKETS = /^\[|\]$/g;
 const NUMERIC_IP = /^[\d.]+$/;
 const HEX_IP = /^0x[0-9a-f]+$/i;
-function isAllowedHref(href) {
+function sanitiseHref(href) {
   const cleaned = href.replace(INVISIBLE_CHARS, '');
   const trimmed = cleaned.trim();
   if (!trimmed) {
-    return false;
+    return undefined;
   }
   if (CONTROL_CHARS.test(trimmed)) {
-    return false;
+    return undefined;
   }
   if (DANGEROUS_HTML_CHARS.test(trimmed)) {
-    return false;
+    return undefined;
   }
   if (DANGEROUS_SCHEME.test(trimmed)) {
-    return false;
+    return undefined;
   }
   if (ENCODED_COLON_SCHEME.test(trimmed)) {
-    return false;
+    return undefined;
   }
   if (trimmed.startsWith('//')) {
-    return false;
+    return undefined;
   }
   if (trimmed.startsWith('\\')) {
-    return false;
+    return undefined;
   }
   if (trimmed.startsWith('/')) {
-    return trimmed[1] !== '\\';
+    return trimmed[1] !== '\\' ? trimmed : undefined;
   }
   if (trimmed.startsWith('#')) {
-    return true;
+    return trimmed;
   }
   if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
-    return false;
+    return undefined;
   }
   try {
     const url = new URL(trimmed);
     if (!constants.ALLOWED_PROTOCOLS.includes(url.protocol)) {
-      return false;
+      return undefined;
     }
     if (url.protocol === 'https:') {
       if (!trimmed.startsWith('https://')) {
-        return false;
+        return undefined;
       }
       if (!url.hostname) {
-        return false;
+        return undefined;
       }
       if (url.username || url.password) {
-        return false;
+        return undefined;
       }
       if (isInternalHost(url.hostname)) {
-        return false;
+        return undefined;
       }
     }
     if (url.protocol === 'mailto:') {
       if (url.search) {
-        return false;
+        return undefined;
       }
       if (!url.pathname) {
-        return false;
+        return undefined;
       }
     }
-    return true;
+    return trimmed;
   } catch {
-    return false;
+    return undefined;
   }
 }
 // Synthetic origin used to resolve relative paths via the WHATWG URL parser.
@@ -87,15 +87,16 @@ function isHrefAllowedByMode(href, mode) {
     case 'all':
       return true;
     case 'internal':
-      if (href.startsWith('https://wise.com/')) return true;
-      if (href.startsWith('/')) {
-        try {
-          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;
-        } catch {
-          return false;
+      try {
+        if (!href.startsWith('/')) {
+          const parsed = new URL(href);
+          return parsed.protocol === 'https:' && parsed.hostname === 'wise.com';
         }
+        const parsed = new URL(href, SSR_SENTINEL_ORIGIN);
+        return parsed.origin === SSR_SENTINEL_ORIGIN;
+      } catch {
+        return false;
       }
-      return false;
   }
 }
 function isInternalHost(hostname) {
@@ -109,6 +110,6 @@ function isInternalHost(hostname) {
   return false;
 }
 
-exports.isAllowedHref = isAllowedHref;
 exports.isHrefAllowedByMode = isHrefAllowedByMode;
+exports.sanitiseHref = sanitiseHref;
 //# sourceMappingURL=sanitise.js.map

package/build/Markup/utils/sanitise.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitise.js","sources":["../../../src/Markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function isAllowedHref(href: string): boolean {\n  const cleaned = href.replace(INVISIBLE_CHARS, '');\n  const trimmed = cleaned.trim();\n\n  if (!trimmed) {\n    return false;\n  }\n\n  if (CONTROL_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (ENCODED_COLON_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (trimmed.startsWith('//')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('\\\\')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('/')) {\n    return trimmed[1] !== '\\\\';\n  }\n\n  if (trimmed.startsWith('#')) {\n    return true;\n  }\n\n  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n    return false;\n  }\n\n  try {\n    const url = new URL(trimmed);\n\n    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n      return false;\n    }\n\n    if (url.protocol === 'https:') {\n      if (!trimmed.startsWith('https://')) {\n        return false;\n      }\n\n      if (!url.hostname) {\n        return false;\n      }\n\n      if (url.username || url.password) {\n        return false;\n      }\n\n      if (isInternalHost(url.hostname)) {\n        return false;\n      }\n    }\n\n    if (url.protocol === 'mailto:') {\n      if (url.search) {\n        return false;\n      }\n\n      if (!url.pathname) {\n        return false;\n      }\n    }\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport type AllowLinksMode = 'internal' | 'all' | 'none';\n\n// Synthetic origin used to resolve relative paths via the WHATWG URL parser.\n// If the resolved origin still equals this sentinel, the path stays on-origin.\nconst SSR_SENTINEL_ORIGIN = 'https://internal.invalid';\n\nexport function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {\n  switch (mode) {\n    case 'none':\n      return false;\n    case 'all':\n      return true;\n    case 'internal':\n      if (href.startsWith('https://wise.com/')) return true;\n      if (href.startsWith('/')) {\n        try {\n          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;\n        } catch {\n          return false;\n        }\n      }\n      return false;\n  }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n  const stripped = hostname.replace(IPV6_BRACKETS, '');\n  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;\n  if (NUMERIC_IP.test(host)) return true;\n  if (HEX_IP.test(host)) return true;\n  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;\n  if (host === 'localhost') return true;\n  if (host.endsWith('.internal')) return true;\n  return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","isAllowedHref","href","cleaned","replace","trimmed","trim","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","SSR_SENTINEL_ORIGIN","isHrefAllowedByMode","mode","origin","stripped","host","endsWith","slice"],"mappings":";;;;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,aAAaA,CAACC,IAAY,EAAA;EACxC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIX,aAAa,CAACa,IAAI,CAACF,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACY,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIT,gBAAgB,CAACW,IAAI,CAACF,OAAO,CAAC,EAAE;AAClC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIR,oBAAoB,CAACU,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOH,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;AAC5B,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAO,IAAI;AACb,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,IAAIH,OAAO,CAACG,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAO,KAAK;AACd,EAAA;EAEA,IAAI;AACF,IAAA,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACL,OAAO,CAAC;IAE5B,IAAI,CAACM,2BAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAO,KAAK;AACd,IAAA;AAEA,IAAA,IAAIJ,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACR,OAAO,CAACG,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACC,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIL,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIC,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,IAAIL,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACT,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,OAAO,IAAI;AACb,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAO,KAAK;AACd,EAAA;AACF;AAIA;AACA;AACA,MAAMC,mBAAmB,GAAG,0BAA0B;AAEhD,SAAUC,mBAAmBA,CAACnB,IAAY,EAAEoB,IAAoB,EAAA;AACpE,EAAA,QAAQA,IAAI;AACV,IAAA,KAAK,MAAM;AACT,MAAA,OAAO,KAAK;AACd,IAAA,KAAK,KAAK;AACR,MAAA,OAAO,IAAI;AACb,IAAA,KAAK,UAAU;MACb,IAAIpB,IAAI,CAACM,UAAU,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACrD,MAAA,IAAIN,IAAI,CAACM,UAAU,CAAC,GAAG,CAAC,EAAE;QACxB,IAAI;UACF,OAAO,IAAIE,GAAG,CAACR,IAAI,EAAEkB,mBAAmB,CAAC,CAACG,MAAM,KAAKH,mBAAmB;AAC1E,QAAA,CAAC,CAAC,MAAM;AACN,UAAA,OAAO,KAAK;AACd,QAAA;AACF,MAAA;AACA,MAAA,OAAO,KAAK;AAChB;AACF;AAEA,SAASH,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMU,QAAQ,GAAGV,QAAQ,CAACV,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;AACpD,EAAA,MAAM2B,IAAI,GAAGD,QAAQ,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAGF,QAAQ,CAACG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAGH,QAAQ;EACtE,IAAIzB,UAAU,CAACQ,IAAI,CAACkB,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAIzB,MAAM,CAACO,IAAI,CAACkB,IAAI,CAAC,EAAE,OAAO,IAAI;EAClC,IAAIA,IAAI,KAAK,KAAK,IAAIA,IAAI,KAAK,iBAAiB,EAAE,OAAO,IAAI;AAC7D,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;;"}
+{"version":3,"file":"sanitise.js","sources":["../../../src/Markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function sanitiseHref(href: string): string | undefined {\n  const cleaned = href.replace(INVISIBLE_CHARS, '');\n  const trimmed = cleaned.trim();\n\n  if (!trimmed) {\n    return undefined;\n  }\n\n  if (CONTROL_CHARS.test(trimmed)) {\n    return undefined;\n  }\n\n  if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n    return undefined;\n  }\n\n  if (DANGEROUS_SCHEME.test(trimmed)) {\n    return undefined;\n  }\n\n  if (ENCODED_COLON_SCHEME.test(trimmed)) {\n    return undefined;\n  }\n\n  if (trimmed.startsWith('//')) {\n    return undefined;\n  }\n\n  if (trimmed.startsWith('\\\\')) {\n    return undefined;\n  }\n\n  if (trimmed.startsWith('/')) {\n    return trimmed[1] !== '\\\\' ? trimmed : undefined;\n  }\n\n  if (trimmed.startsWith('#')) {\n    return trimmed;\n  }\n\n  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n    return undefined;\n  }\n\n  try {\n    const url = new URL(trimmed);\n\n    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n      return undefined;\n    }\n\n    if (url.protocol === 'https:') {\n      if (!trimmed.startsWith('https://')) {\n        return undefined;\n      }\n\n      if (!url.hostname) {\n        return undefined;\n      }\n\n      if (url.username || url.password) {\n        return undefined;\n      }\n\n      if (isInternalHost(url.hostname)) {\n        return undefined;\n      }\n    }\n\n    if (url.protocol === 'mailto:') {\n      if (url.search) {\n        return undefined;\n      }\n\n      if (!url.pathname) {\n        return undefined;\n      }\n    }\n\n    return trimmed;\n  } catch {\n    return undefined;\n  }\n}\n\nexport type AllowLinksMode = 'internal' | 'all' | 'none';\n\n// Synthetic origin used to resolve relative paths via the WHATWG URL parser.\n// If the resolved origin still equals this sentinel, the path stays on-origin.\nconst SSR_SENTINEL_ORIGIN = 'https://internal.invalid';\n\nexport function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {\n  switch (mode) {\n    case 'none':\n      return false;\n    case 'all':\n      return true;\n    case 'internal':\n      try {\n        if (!href.startsWith('/')) {\n          const parsed = new URL(href);\n          return parsed.protocol === 'https:' && parsed.hostname === 'wise.com';\n        }\n        const parsed = new URL(href, SSR_SENTINEL_ORIGIN);\n        return parsed.origin === SSR_SENTINEL_ORIGIN;\n      } catch {\n        return false;\n      }\n  }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n  const stripped = hostname.replace(IPV6_BRACKETS, '');\n  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;\n  if (NUMERIC_IP.test(host)) return true;\n  if (HEX_IP.test(host)) return true;\n  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;\n  if (host === 'localhost') return true;\n  if (host.endsWith('.internal')) return true;\n  return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","sanitiseHref","href","cleaned","replace","trimmed","trim","undefined","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","SSR_SENTINEL_ORIGIN","isHrefAllowedByMode","mode","parsed","origin","stripped","host","endsWith","slice"],"mappings":";;;;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,YAAYA,CAACC,IAAY,EAAA;EACvC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIb,aAAa,CAACc,IAAI,CAACH,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIZ,oBAAoB,CAACa,IAAI,CAACH,OAAO,CAAC,EAAE;AACtC,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIX,gBAAgB,CAACY,IAAI,CAACH,OAAO,CAAC,EAAE;AAClC,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACW,IAAI,CAACH,OAAO,CAAC,EAAE;AACtC,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAOF,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAOF,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,GAAG,CAAC,EAAE;IAC3B,OAAOJ,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,GAAGA,OAAO,GAAGE,SAAS;AAClD,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOJ,OAAO;AAChB,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACI,UAAU,CAAC,IAAI,CAAC,IAAIJ,OAAO,CAACI,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAOF,SAAS;AAClB,EAAA;EAEA,IAAI;AACF,IAAA,MAAMG,GAAG,GAAG,IAAIC,GAAG,CAACN,OAAO,CAAC;IAE5B,IAAI,CAACO,2BAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAOP,SAAS;AAClB,IAAA;AAEA,IAAA,IAAIG,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACT,OAAO,CAACI,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAOF,SAAS;AAClB,MAAA;AAEA,MAAA,IAAI,CAACG,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAOR,SAAS;AAClB,MAAA;AAEA,MAAA,IAAIG,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAOV,SAAS;AAClB,MAAA;AAEA,MAAA,IAAIW,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAOR,SAAS;AAClB,MAAA;AACF,IAAA;AAEA,IAAA,IAAIG,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAOZ,SAAS;AAClB,MAAA;AAEA,MAAA,IAAI,CAACG,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAOb,SAAS;AAClB,MAAA;AACF,IAAA;AAEA,IAAA,OAAOF,OAAO;AAChB,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAOE,SAAS;AAClB,EAAA;AACF;AAIA;AACA;AACA,MAAMc,mBAAmB,GAAG,0BAA0B;AAEhD,SAAUC,mBAAmBA,CAACpB,IAAY,EAAEqB,IAAoB,EAAA;AACpE,EAAA,QAAQA,IAAI;AACV,IAAA,KAAK,MAAM;AACT,MAAA,OAAO,KAAK;AACd,IAAA,KAAK,KAAK;AACR,MAAA,OAAO,IAAI;AACb,IAAA,KAAK,UAAU;MACb,IAAI;AACF,QAAA,IAAI,CAACrB,IAAI,CAACO,UAAU,CAAC,GAAG,CAAC,EAAE;AACzB,UAAA,MAAMe,MAAM,GAAG,IAAIb,GAAG,CAACT,IAAI,CAAC;UAC5B,OAAOsB,MAAM,CAACV,QAAQ,KAAK,QAAQ,IAAIU,MAAM,CAACT,QAAQ,KAAK,UAAU;AACvE,QAAA;QACA,MAAMS,MAAM,GAAG,IAAIb,GAAG,CAACT,IAAI,EAAEmB,mBAAmB,CAAC;AACjD,QAAA,OAAOG,MAAM,CAACC,MAAM,KAAKJ,mBAAmB;AAC9C,MAAA,CAAC,CAAC,MAAM;AACN,QAAA,OAAO,KAAK;AACd,MAAA;AACJ;AACF;AAEA,SAASH,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMW,QAAQ,GAAGX,QAAQ,CAACX,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;AACpD,EAAA,MAAM6B,IAAI,GAAGD,QAAQ,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAGF,QAAQ,CAACG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAGH,QAAQ;EACtE,IAAI3B,UAAU,CAACS,IAAI,CAACmB,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAI3B,MAAM,CAACQ,IAAI,CAACmB,IAAI,CAAC,EAAE,OAAO,IAAI;EAClC,IAAIA,IAAI,KAAK,KAAK,IAAIA,IAAI,KAAK,iBAAiB,EAAE,OAAO,IAAI;AAC7D,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;;"}

package/build/Markup/utils/sanitise.mjs

@@ -10,69 +10,69 @@ const ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;
 const IPV6_BRACKETS = /^\[|\]$/g;
 const NUMERIC_IP = /^[\d.]+$/;
 const HEX_IP = /^0x[0-9a-f]+$/i;
-function isAllowedHref(href) {
+function sanitiseHref(href) {
   const cleaned = href.replace(INVISIBLE_CHARS, '');
   const trimmed = cleaned.trim();
   if (!trimmed) {
-    return false;
+    return undefined;
   }
   if (CONTROL_CHARS.test(trimmed)) {
-    return false;
+    return undefined;
   }
   if (DANGEROUS_HTML_CHARS.test(trimmed)) {
-    return false;
+    return undefined;
   }
   if (DANGEROUS_SCHEME.test(trimmed)) {
-    return false;
+    return undefined;
   }
   if (ENCODED_COLON_SCHEME.test(trimmed)) {
-    return false;
+    return undefined;
   }
   if (trimmed.startsWith('//')) {
-    return false;
+    return undefined;
   }
   if (trimmed.startsWith('\\')) {
-    return false;
+    return undefined;
   }
   if (trimmed.startsWith('/')) {
-    return trimmed[1] !== '\\';
+    return trimmed[1] !== '\\' ? trimmed : undefined;
   }
   if (trimmed.startsWith('#')) {
-    return true;
+    return trimmed;
   }
   if (trimmed.startsWith('./') || trimmed.startsWith('../')) {
-    return false;
+    return undefined;
   }
   try {
     const url = new URL(trimmed);
     if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
-      return false;
+      return undefined;
     }
     if (url.protocol === 'https:') {
       if (!trimmed.startsWith('https://')) {
-        return false;
+        return undefined;
       }
       if (!url.hostname) {
-        return false;
+        return undefined;
       }
       if (url.username || url.password) {
-        return false;
+        return undefined;
       }
       if (isInternalHost(url.hostname)) {
-        return false;
+        return undefined;
       }
     }
     if (url.protocol === 'mailto:') {
       if (url.search) {
-        return false;
+        return undefined;
       }
       if (!url.pathname) {
-        return false;
+        return undefined;
       }
     }
-    return true;
+    return trimmed;
   } catch {
-    return false;
+    return undefined;
   }
 }
 // Synthetic origin used to resolve relative paths via the WHATWG URL parser.
@@ -85,15 +85,16 @@ function isHrefAllowedByMode(href, mode) {
     case 'all':
       return true;
     case 'internal':
-      if (href.startsWith('https://wise.com/')) return true;
-      if (href.startsWith('/')) {
-        try {
-          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;
-        } catch {
-          return false;
+      try {
+        if (!href.startsWith('/')) {
+          const parsed = new URL(href);
+          return parsed.protocol === 'https:' && parsed.hostname === 'wise.com';
         }
+        const parsed = new URL(href, SSR_SENTINEL_ORIGIN);
+        return parsed.origin === SSR_SENTINEL_ORIGIN;
+      } catch {
+        return false;
       }
-      return false;
   }
 }
 function isInternalHost(hostname) {
@@ -107,5 +108,5 @@ function isInternalHost(hostname) {
   return false;
 }
 
-export { isAllowedHref, isHrefAllowedByMode };
+export { isHrefAllowedByMode, sanitiseHref };
 //# sourceMappingURL=sanitise.mjs.map

package/build/Markup/utils/sanitise.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sanitise.mjs","sources":["../../../src/Markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function isAllowedHref(href: string): boolean {\n  const cleaned = href.replace(INVISIBLE_CHARS, '');\n  const trimmed = cleaned.trim();\n\n  if (!trimmed) {\n    return false;\n  }\n\n  if (CONTROL_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n    return false;\n  }\n\n  if (DANGEROUS_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (ENCODED_COLON_SCHEME.test(trimmed)) {\n    return false;\n  }\n\n  if (trimmed.startsWith('//')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('\\\\')) {\n    return false;\n  }\n\n  if (trimmed.startsWith('/')) {\n    return trimmed[1] !== '\\\\';\n  }\n\n  if (trimmed.startsWith('#')) {\n    return true;\n  }\n\n  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n    return false;\n  }\n\n  try {\n    const url = new URL(trimmed);\n\n    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n      return false;\n    }\n\n    if (url.protocol === 'https:') {\n      if (!trimmed.startsWith('https://')) {\n        return false;\n      }\n\n      if (!url.hostname) {\n        return false;\n      }\n\n      if (url.username || url.password) {\n        return false;\n      }\n\n      if (isInternalHost(url.hostname)) {\n        return false;\n      }\n    }\n\n    if (url.protocol === 'mailto:') {\n      if (url.search) {\n        return false;\n      }\n\n      if (!url.pathname) {\n        return false;\n      }\n    }\n\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport type AllowLinksMode = 'internal' | 'all' | 'none';\n\n// Synthetic origin used to resolve relative paths via the WHATWG URL parser.\n// If the resolved origin still equals this sentinel, the path stays on-origin.\nconst SSR_SENTINEL_ORIGIN = 'https://internal.invalid';\n\nexport function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {\n  switch (mode) {\n    case 'none':\n      return false;\n    case 'all':\n      return true;\n    case 'internal':\n      if (href.startsWith('https://wise.com/')) return true;\n      if (href.startsWith('/')) {\n        try {\n          return new URL(href, SSR_SENTINEL_ORIGIN).origin === SSR_SENTINEL_ORIGIN;\n        } catch {\n          return false;\n        }\n      }\n      return false;\n  }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n  const stripped = hostname.replace(IPV6_BRACKETS, '');\n  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;\n  if (NUMERIC_IP.test(host)) return true;\n  if (HEX_IP.test(host)) return true;\n  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;\n  if (host === 'localhost') return true;\n  if (host.endsWith('.internal')) return true;\n  return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","isAllowedHref","href","cleaned","replace","trimmed","trim","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","SSR_SENTINEL_ORIGIN","isHrefAllowedByMode","mode","origin","stripped","host","endsWith","slice"],"mappings":";;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,aAAaA,CAACC,IAAY,EAAA;EACxC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIX,aAAa,CAACa,IAAI,CAACF,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACY,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIT,gBAAgB,CAACW,IAAI,CAACF,OAAO,CAAC,EAAE;AAClC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIR,oBAAoB,CAACU,IAAI,CAACF,OAAO,CAAC,EAAE;AACtC,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAO,KAAK;AACd,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOH,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;AAC5B,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACG,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAO,IAAI;AACb,EAAA;AAEA,EAAA,IAAIH,OAAO,CAACG,UAAU,CAAC,IAAI,CAAC,IAAIH,OAAO,CAACG,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAO,KAAK;AACd,EAAA;EAEA,IAAI;AACF,IAAA,MAAMC,GAAG,GAAG,IAAIC,GAAG,CAACL,OAAO,CAAC;IAE5B,IAAI,CAACM,iBAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAO,KAAK;AACd,IAAA;AAEA,IAAA,IAAIJ,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACR,OAAO,CAACG,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACC,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIL,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAIC,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,IAAIL,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAO,KAAK;AACd,MAAA;AAEA,MAAA,IAAI,CAACT,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAO,KAAK;AACd,MAAA;AACF,IAAA;AAEA,IAAA,OAAO,IAAI;AACb,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAO,KAAK;AACd,EAAA;AACF;AAIA;AACA;AACA,MAAMC,mBAAmB,GAAG,0BAA0B;AAEhD,SAAUC,mBAAmBA,CAACnB,IAAY,EAAEoB,IAAoB,EAAA;AACpE,EAAA,QAAQA,IAAI;AACV,IAAA,KAAK,MAAM;AACT,MAAA,OAAO,KAAK;AACd,IAAA,KAAK,KAAK;AACR,MAAA,OAAO,IAAI;AACb,IAAA,KAAK,UAAU;MACb,IAAIpB,IAAI,CAACM,UAAU,CAAC,mBAAmB,CAAC,EAAE,OAAO,IAAI;AACrD,MAAA,IAAIN,IAAI,CAACM,UAAU,CAAC,GAAG,CAAC,EAAE;QACxB,IAAI;UACF,OAAO,IAAIE,GAAG,CAACR,IAAI,EAAEkB,mBAAmB,CAAC,CAACG,MAAM,KAAKH,mBAAmB;AAC1E,QAAA,CAAC,CAAC,MAAM;AACN,UAAA,OAAO,KAAK;AACd,QAAA;AACF,MAAA;AACA,MAAA,OAAO,KAAK;AAChB;AACF;AAEA,SAASH,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMU,QAAQ,GAAGV,QAAQ,CAACV,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;AACpD,EAAA,MAAM2B,IAAI,GAAGD,QAAQ,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAGF,QAAQ,CAACG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAGH,QAAQ;EACtE,IAAIzB,UAAU,CAACQ,IAAI,CAACkB,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAIzB,MAAM,CAACO,IAAI,CAACkB,IAAI,CAAC,EAAE,OAAO,IAAI;EAClC,IAAIA,IAAI,KAAK,KAAK,IAAIA,IAAI,KAAK,iBAAiB,EAAE,OAAO,IAAI;AAC7D,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;"}
+{"version":3,"file":"sanitise.mjs","sources":["../../../src/Markup/utils/sanitise.ts"],"sourcesContent":["import { ALLOWED_PROTOCOLS } from '../constants';\n\nconst INVISIBLE_CHARS = /[\\u200b\\u200c\\u200d\\ufeff\\u00ad\\u2060\\u180e]/g;\n// eslint-disable-next-line regexp/no-control-character\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst DANGEROUS_HTML_CHARS = /[<>\"']/;\nconst DANGEROUS_SCHEME = /^(?:javascript|vbscript|data|jscript)\\s*:/i;\n// eslint-disable-next-line regexp/no-useless-non-capturing-group\nconst ENCODED_COLON_SCHEME = /^(?:javascript|vbscript|data|jscript)(?:%3a)/i;\nconst IPV6_BRACKETS = /^\\[|\\]$/g;\nconst NUMERIC_IP = /^[\\d.]+$/;\nconst HEX_IP = /^0x[0-9a-f]+$/i;\n\nexport function sanitiseHref(href: string): string | undefined {\n  const cleaned = href.replace(INVISIBLE_CHARS, '');\n  const trimmed = cleaned.trim();\n\n  if (!trimmed) {\n    return undefined;\n  }\n\n  if (CONTROL_CHARS.test(trimmed)) {\n    return undefined;\n  }\n\n  if (DANGEROUS_HTML_CHARS.test(trimmed)) {\n    return undefined;\n  }\n\n  if (DANGEROUS_SCHEME.test(trimmed)) {\n    return undefined;\n  }\n\n  if (ENCODED_COLON_SCHEME.test(trimmed)) {\n    return undefined;\n  }\n\n  if (trimmed.startsWith('//')) {\n    return undefined;\n  }\n\n  if (trimmed.startsWith('\\\\')) {\n    return undefined;\n  }\n\n  if (trimmed.startsWith('/')) {\n    return trimmed[1] !== '\\\\' ? trimmed : undefined;\n  }\n\n  if (trimmed.startsWith('#')) {\n    return trimmed;\n  }\n\n  if (trimmed.startsWith('./') || trimmed.startsWith('../')) {\n    return undefined;\n  }\n\n  try {\n    const url = new URL(trimmed);\n\n    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {\n      return undefined;\n    }\n\n    if (url.protocol === 'https:') {\n      if (!trimmed.startsWith('https://')) {\n        return undefined;\n      }\n\n      if (!url.hostname) {\n        return undefined;\n      }\n\n      if (url.username || url.password) {\n        return undefined;\n      }\n\n      if (isInternalHost(url.hostname)) {\n        return undefined;\n      }\n    }\n\n    if (url.protocol === 'mailto:') {\n      if (url.search) {\n        return undefined;\n      }\n\n      if (!url.pathname) {\n        return undefined;\n      }\n    }\n\n    return trimmed;\n  } catch {\n    return undefined;\n  }\n}\n\nexport type AllowLinksMode = 'internal' | 'all' | 'none';\n\n// Synthetic origin used to resolve relative paths via the WHATWG URL parser.\n// If the resolved origin still equals this sentinel, the path stays on-origin.\nconst SSR_SENTINEL_ORIGIN = 'https://internal.invalid';\n\nexport function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean {\n  switch (mode) {\n    case 'none':\n      return false;\n    case 'all':\n      return true;\n    case 'internal':\n      try {\n        if (!href.startsWith('/')) {\n          const parsed = new URL(href);\n          return parsed.protocol === 'https:' && parsed.hostname === 'wise.com';\n        }\n        const parsed = new URL(href, SSR_SENTINEL_ORIGIN);\n        return parsed.origin === SSR_SENTINEL_ORIGIN;\n      } catch {\n        return false;\n      }\n  }\n}\n\nfunction isInternalHost(hostname: string): boolean {\n  const stripped = hostname.replace(IPV6_BRACKETS, '');\n  const host = stripped.endsWith('.') ? stripped.slice(0, -1) : stripped;\n  if (NUMERIC_IP.test(host)) return true;\n  if (HEX_IP.test(host)) return true;\n  if (host === '::1' || host === '0:0:0:0:0:0:0:1') return true;\n  if (host === 'localhost') return true;\n  if (host.endsWith('.internal')) return true;\n  return false;\n}\n"],"names":["INVISIBLE_CHARS","CONTROL_CHARS","DANGEROUS_HTML_CHARS","DANGEROUS_SCHEME","ENCODED_COLON_SCHEME","IPV6_BRACKETS","NUMERIC_IP","HEX_IP","sanitiseHref","href","cleaned","replace","trimmed","trim","undefined","test","startsWith","url","URL","ALLOWED_PROTOCOLS","includes","protocol","hostname","username","password","isInternalHost","search","pathname","SSR_SENTINEL_ORIGIN","isHrefAllowedByMode","mode","parsed","origin","stripped","host","endsWith","slice"],"mappings":";;AAEA,MAAMA,eAAe,GAAG,+CAA+C;AACvE;AACA,MAAMC,aAAa,GAAG,8BAA8B;AACpD,MAAMC,oBAAoB,GAAG,QAAQ;AACrC,MAAMC,gBAAgB,GAAG,4CAA4C;AACrE;AACA,MAAMC,oBAAoB,GAAG,+CAA+C;AAC5E,MAAMC,aAAa,GAAG,UAAU;AAChC,MAAMC,UAAU,GAAG,UAAU;AAC7B,MAAMC,MAAM,GAAG,gBAAgB;AAEzB,SAAUC,YAAYA,CAACC,IAAY,EAAA;EACvC,MAAMC,OAAO,GAAGD,IAAI,CAACE,OAAO,CAACX,eAAe,EAAE,EAAE,CAAC;AACjD,EAAA,MAAMY,OAAO,GAAGF,OAAO,CAACG,IAAI,EAAE;EAE9B,IAAI,CAACD,OAAO,EAAE;AACZ,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIb,aAAa,CAACc,IAAI,CAACH,OAAO,CAAC,EAAE;AAC/B,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIZ,oBAAoB,CAACa,IAAI,CAACH,OAAO,CAAC,EAAE;AACtC,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIX,gBAAgB,CAACY,IAAI,CAACH,OAAO,CAAC,EAAE;AAClC,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIV,oBAAoB,CAACW,IAAI,CAACH,OAAO,CAAC,EAAE;AACtC,IAAA,OAAOE,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAOF,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,IAAI,CAAC,EAAE;AAC5B,IAAA,OAAOF,SAAS;AAClB,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,GAAG,CAAC,EAAE;IAC3B,OAAOJ,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,GAAGA,OAAO,GAAGE,SAAS;AAClD,EAAA;AAEA,EAAA,IAAIF,OAAO,CAACI,UAAU,CAAC,GAAG,CAAC,EAAE;AAC3B,IAAA,OAAOJ,OAAO;AAChB,EAAA;AAEA,EAAA,IAAIA,OAAO,CAACI,UAAU,CAAC,IAAI,CAAC,IAAIJ,OAAO,CAACI,UAAU,CAAC,KAAK,CAAC,EAAE;AACzD,IAAA,OAAOF,SAAS;AAClB,EAAA;EAEA,IAAI;AACF,IAAA,MAAMG,GAAG,GAAG,IAAIC,GAAG,CAACN,OAAO,CAAC;IAE5B,IAAI,CAACO,iBAAiB,CAACC,QAAQ,CAACH,GAAG,CAACI,QAAQ,CAAC,EAAE;AAC7C,MAAA,OAAOP,SAAS;AAClB,IAAA;AAEA,IAAA,IAAIG,GAAG,CAACI,QAAQ,KAAK,QAAQ,EAAE;AAC7B,MAAA,IAAI,CAACT,OAAO,CAACI,UAAU,CAAC,UAAU,CAAC,EAAE;AACnC,QAAA,OAAOF,SAAS;AAClB,MAAA;AAEA,MAAA,IAAI,CAACG,GAAG,CAACK,QAAQ,EAAE;AACjB,QAAA,OAAOR,SAAS;AAClB,MAAA;AAEA,MAAA,IAAIG,GAAG,CAACM,QAAQ,IAAIN,GAAG,CAACO,QAAQ,EAAE;AAChC,QAAA,OAAOV,SAAS;AAClB,MAAA;AAEA,MAAA,IAAIW,cAAc,CAACR,GAAG,CAACK,QAAQ,CAAC,EAAE;AAChC,QAAA,OAAOR,SAAS;AAClB,MAAA;AACF,IAAA;AAEA,IAAA,IAAIG,GAAG,CAACI,QAAQ,KAAK,SAAS,EAAE;MAC9B,IAAIJ,GAAG,CAACS,MAAM,EAAE;AACd,QAAA,OAAOZ,SAAS;AAClB,MAAA;AAEA,MAAA,IAAI,CAACG,GAAG,CAACU,QAAQ,EAAE;AACjB,QAAA,OAAOb,SAAS;AAClB,MAAA;AACF,IAAA;AAEA,IAAA,OAAOF,OAAO;AAChB,EAAA,CAAC,CAAC,MAAM;AACN,IAAA,OAAOE,SAAS;AAClB,EAAA;AACF;AAIA;AACA;AACA,MAAMc,mBAAmB,GAAG,0BAA0B;AAEhD,SAAUC,mBAAmBA,CAACpB,IAAY,EAAEqB,IAAoB,EAAA;AACpE,EAAA,QAAQA,IAAI;AACV,IAAA,KAAK,MAAM;AACT,MAAA,OAAO,KAAK;AACd,IAAA,KAAK,KAAK;AACR,MAAA,OAAO,IAAI;AACb,IAAA,KAAK,UAAU;MACb,IAAI;AACF,QAAA,IAAI,CAACrB,IAAI,CAACO,UAAU,CAAC,GAAG,CAAC,EAAE;AACzB,UAAA,MAAMe,MAAM,GAAG,IAAIb,GAAG,CAACT,IAAI,CAAC;UAC5B,OAAOsB,MAAM,CAACV,QAAQ,KAAK,QAAQ,IAAIU,MAAM,CAACT,QAAQ,KAAK,UAAU;AACvE,QAAA;QACA,MAAMS,MAAM,GAAG,IAAIb,GAAG,CAACT,IAAI,EAAEmB,mBAAmB,CAAC;AACjD,QAAA,OAAOG,MAAM,CAACC,MAAM,KAAKJ,mBAAmB;AAC9C,MAAA,CAAC,CAAC,MAAM;AACN,QAAA,OAAO,KAAK;AACd,MAAA;AACJ;AACF;AAEA,SAASH,cAAcA,CAACH,QAAgB,EAAA;EACtC,MAAMW,QAAQ,GAAGX,QAAQ,CAACX,OAAO,CAACN,aAAa,EAAE,EAAE,CAAC;AACpD,EAAA,MAAM6B,IAAI,GAAGD,QAAQ,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAGF,QAAQ,CAACG,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAGH,QAAQ;EACtE,IAAI3B,UAAU,CAACS,IAAI,CAACmB,IAAI,CAAC,EAAE,OAAO,IAAI;EACtC,IAAI3B,MAAM,CAACQ,IAAI,CAACmB,IAAI,CAAC,EAAE,OAAO,IAAI;EAClC,IAAIA,IAAI,KAAK,KAAK,IAAIA,IAAI,KAAK,iBAAiB,EAAE,OAAO,IAAI;AAC7D,EAAA,IAAIA,IAAI,KAAK,WAAW,EAAE,OAAO,IAAI;EACrC,IAAIA,IAAI,CAACC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,IAAI;AAC3C,EAAA,OAAO,KAAK;AACd;;;;"}

package/build/types/Markup/Markup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Markup.d.ts","sourceRoot":"","sources":["../../../src/Markup/Markup.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4B,MAAM,OAAO,CAAC;AAMjD,OAAO,KAAK,EAA6B,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA+G7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAoCxC,CAAC;AAEF,eAAe,MAAM,CAAC"}
+{"version":3,"file":"Markup.d.ts","sourceRoot":"","sources":["../../../src/Markup/Markup.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4B,MAAM,OAAO,CAAC;AAMjD,OAAO,KAAK,EAA6B,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAqH7E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,WAAW,CAoCxC,CAAC;AAEF,eAAe,MAAM,CAAC"}

package/build/types/Markup/constants.d.ts

@@ -1,18 +1,4 @@
 export declare const ALLOWED_TAGS: readonly ["important", "positive", "negative", "strong", "strikethrough", "paragraph", "p", "link", "a"];
-/**
- * Matches opening and closing tags from the ALLOWED_TAGS allow-list.
- *
- * Capture groups:
- *  1. `/` if this is a closing tag, undefined otherwise
- *  2. Tag name
- *  3. Raw attribute string between the tag name and `>` (empty for closing tags)
- *
- * The lookahead `(?=[\s>/])` after the tag name ensures we don't match partial
- * words — e.g. `<stronger>` won't be matched as `<strong>`.
- *
- * Global flag (`g`) allows iterative matching via `exec()`.
- */
-export declare const TAG_REGEX: RegExp;
 export declare const TAG_ALIASES: Record<string, string>;
 export declare const MAX_NESTING_DEPTH = 32;
 export declare const ALLOWED_TARGETS: string[];

package/build/types/Markup/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/Markup/constants.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,0GAUf,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,SAAS,QAGrB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAiC,CAAC;AAGjF,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAGpC,eAAO,MAAM,eAAe,UAAsB,CAAC;AAGnD,eAAO,MAAM,iBAAiB,UAAwB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/Markup/constants.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,0GAUf,CAAC;AAEX,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAiC,CAAC;AAGjF,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAGpC,eAAO,MAAM,eAAe,UAAsB,CAAC;AAGnD,eAAO,MAAM,iBAAiB,UAAwB,CAAC"}

package/build/types/Markup/utils/parseMarkup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parseMarkup.d.ts","sourceRoot":"","sources":["../../../../src/Markup/utils/parseMarkup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,iBAAiB,EAA0B,MAAM,cAAc,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAuNlD,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAYvD"}
+{"version":3,"file":"parseMarkup.d.ts","sourceRoot":"","sources":["../../../../src/Markup/utils/parseMarkup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,iBAAiB,EAAe,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,eAAO,MAAM,gBAAgB,QAAS,CAAC;AACvC,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAsPlD,oGAAoG;AACpG,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAYvD"}

package/build/types/Markup/utils/sanitise.d.ts

@@ -1,4 +1,4 @@
-export declare function isAllowedHref(href: string): boolean;
+export declare function sanitiseHref(href: string): string | undefined;
 export type AllowLinksMode = 'internal' | 'all' | 'none';
 export declare function isHrefAllowedByMode(href: string, mode: AllowLinksMode): boolean;
 //# sourceMappingURL=sanitise.d.ts.map

package/build/types/Markup/utils/sanitise.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitise.d.ts","sourceRoot":"","sources":["../../../../src/Markup/utils/sanitise.ts"],"names":[],"mappings":"AAaA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAmFnD;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;AAMzD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAiB/E"}
+{"version":3,"file":"sanitise.d.ts","sourceRoot":"","sources":["../../../../src/Markup/utils/sanitise.ts"],"names":[],"mappings":"AAaA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmF7D;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;AAMzD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAkB/E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@transferwise/components",
-  "version": "0.0.0-experimental-1d81581",
+  "version": "0.0.0-experimental-a06eb0d",
   "description": "Neptune React components",
   "license": "Apache-2.0",
   "repository": {

package/src/Markup/Markup.tsx

@@ -3,7 +3,7 @@ import React, { Fragment, useMemo } from 'react';
 import Link from '../Link';
 
 import { parseMarkup } from './utils/parseMarkup';
-import { type AllowLinksMode, isAllowedHref, isHrefAllowedByMode } from './utils/sanitise';
+import { type AllowLinksMode, isHrefAllowedByMode, sanitiseHref } from './utils/sanitise';
 import type { MarkupActions, MarkupNode, MarkupProps } from './Markup.types';
 
 const PLACEHOLDER_REGEX = /\{\{(\w+)\}\}/g;
@@ -43,9 +43,15 @@ function renderLinkNode(
     );
   }
 
-  if (node.href && isAllowedHref(node.href) && isHrefAllowedByMode(node.href, allowLinks)) {
+  const sanitisedHref = node.href ? sanitiseHref(node.href) : undefined;
+  if (sanitisedHref && isHrefAllowedByMode(sanitisedHref, allowLinks)) {
     return (
-      <Link key={key} href={node.href} target={node.target} aria-label={node.accessibilityLabel}>
+      <Link
+        key={key}
+        href={sanitisedHref}
+        target={node.target}
+        aria-label={node.accessibilityLabel}
+      >
         {children}
       </Link>
     );

package/src/Markup/constants.ts

@@ -11,24 +11,6 @@ export const ALLOWED_TAGS = [
   'a',
 ] as const;
 
-/**
- * Matches opening and closing tags from the ALLOWED_TAGS allow-list.
- *
- * Capture groups:
- *  1. `/` if this is a closing tag, undefined otherwise
- *  2. Tag name
- *  3. Raw attribute string between the tag name and `>` (empty for closing tags)
- *
- * The lookahead `(?=[\s>/])` after the tag name ensures we don't match partial
- * words — e.g. `<stronger>` won't be matched as `<strong>`.
- *
- * Global flag (`g`) allows iterative matching via `exec()`.
- */
-export const TAG_REGEX = new RegExp(
-  `<(\\/)?(${ALLOWED_TAGS.join('|')})(?=[\\s>/])((?:[^>"']*(?:"[^"]*"|'[^']*'))*[^>"']*)>`,
-  'g',
-);
-
 export const TAG_ALIASES: Record<string, string> = { p: 'paragraph', a: 'link' };
 
 // Maximum recursive nesting before the parser emits tags as literal text (DoS protection)

package/src/Markup/utils/parseMarkup.test.ts

@@ -495,7 +495,7 @@ describe('parseMarkup', () => {
     it('captures full href even when it contains > inside quotes', () => {
       const result = parseMarkup('<link href="</link>">remaining text</link>');
       // TAG_REGEX sees through > inside quotes — full href is captured
-      // isAllowedHref (at render time) blocks it because it contains <
+      // sanitiseHref (at render time) blocks it because it contains <
       expect(result).toEqual([
         {
           type: 'link',
@@ -636,10 +636,10 @@ describe('parseMarkup', () => {
   });
 
   describe('SVG/IMG in attribute values', () => {
-    it('extracts href containing img tag (blocked by isAllowedHref at render)', () => {
+    it('extracts href containing img tag (blocked by sanitiseHref at render)', () => {
       const result = parseMarkup('<link href="<img src=x onerror=alert(1)>">text</link>');
       // TAG_REGEX now captures > inside quotes — full href is extracted
-      // isAllowedHref blocks it at render time (contains < and >)
+      // sanitiseHref blocks it at render time (contains < and >)
       expect(result).toEqual([
         {
           type: 'link',
@@ -668,13 +668,13 @@ describe('parseMarkup', () => {
     });
 
     it('parses normally at exactly MAX_INPUT_LENGTH', () => {
-      const input = `<important>${  'x'.repeat(MAX_INPUT_LENGTH - 24)  }</important>`;
+      const input = `<important>${'x'.repeat(MAX_INPUT_LENGTH - 24)}</important>`;
       const result = parseMarkup(input);
       expect(result[0]).toHaveProperty('type', 'important');
     });
 
     it('does not parse markup tags in oversized input', () => {
-      const input = `<important>text</important>${  'x'.repeat(MAX_INPUT_LENGTH)}`;
+      const input = `<important>text</important>${'x'.repeat(MAX_INPUT_LENGTH)}`;
       const result = parseMarkup(input);
       expect(result).toEqual([{ type: 'text', content: input }]);
     });

package/src/Markup/utils/parseMarkup.ts

@@ -1,4 +1,4 @@
-import { ALLOWED_TARGETS, MAX_NESTING_DEPTH, TAG_ALIASES, TAG_REGEX } from '../constants';
+import { ALLOWED_TAGS, ALLOWED_TARGETS, MAX_NESTING_DEPTH, TAG_ALIASES } from '../constants';
 import { MarkupNode } from '../Markup.types';
 
 export { MAX_NESTING_DEPTH };
@@ -11,6 +11,24 @@ const OBJECT_PROTOTYPE_KEYS = new Set(Object.getOwnPropertyNames(Object.prototyp
 const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/g;
 const HTML_METACHAR = /[<>"']/g;
 
+/**
+ * Matches opening and closing tags from the ALLOWED_TAGS allow-list.
+ *
+ * Capture groups:
+ *  1. `/` if this is a closing tag, undefined otherwise
+ *  2. Tag name
+ *  3. Raw attribute string between the tag name and `>` (empty for closing tags)
+ *
+ * The lookahead `(?=[\s>/])` after the tag name ensures we don't match partial
+ * words — e.g. `<stronger>` won't be matched as `<strong>`.
+ *
+ * Global flag (`g`) allows iterative matching via `exec()`.
+ */
+const TAG_REGEX = new RegExp(
+  `<(\\/)?(${ALLOWED_TAGS.join('|')})(?=[\\s>/])((?:[^>"']*(?:"[^"]*"|'[^']*'))*[^>"']*)>`,
+  'g',
+);
+
 type Token =
   | { type: 'text'; content: string }
   | { type: 'newline' }
@@ -157,6 +175,19 @@ function buildNode(rawTag: string, attrs: string, children: MarkupNode[]): Marku
   } as MarkupNode;
 }
 
+/**
+ * Matches allow-listed attributes from the raw attribute string captured by TAG_REGEX.
+ * Requires whitespace before each attribute name to prevent matching inside quoted values.
+ *
+ * Example: for input ` href="https://wise.com" target="_blank"`
+ *  - Match 1: groups = ['href', 'https://wise.com', undefined]
+ *  - Match 2: groups = ['target', '_blank', undefined]
+ *
+ * Capture groups:
+ *  1. Attribute name (href, action, target, or accessibilityLabel)
+ *  2. Double-quoted value (if present)
+ *  3. Single-quoted value (if present)
+ */
 const ATTR_REGEX = /(?<=\s)(href|action|target|accessibilityLabel)=(?:"([^"]*)"|'([^']*)')/g;
 
 type ParsedAttributes = {
@@ -214,7 +245,7 @@ function sanitizeAttributeValue(
     case 'accessibilityLabel':
       return value.replace(HTML_METACHAR, '').slice(0, MAX_ACCESSIBILITY_LABEL_LENGTH);
     default:
-      return value;
+      return undefined;
   }
 }